1 /*- 2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25 */ 26 27 #include <sys/cdefs.h> 28 #include "opt_inet6.h" 29 #include "opt_ipstealth.h" 30 31 #include <sys/param.h> 32 #include <sys/systm.h> 33 #include <sys/mbuf.h> 34 #include <sys/socket.h> 35 #include <sys/kernel.h> 36 #include <sys/sysctl.h> 37 38 #include <net/if.h> 39 #include <net/if_var.h> 40 #include <net/if_private.h> 41 #include <net/route.h> 42 #include <net/route/nhop.h> 43 #include <net/pfil.h> 44 #include <net/vnet.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_kdtrace.h> 48 #include <netinet/in_var.h> 49 #include <netinet/ip_var.h> 50 #include <netinet/ip6.h> 51 #include <netinet/icmp6.h> 52 #include <netinet6/in6_var.h> 53 #include <netinet6/in6_fib.h> 54 #include <netinet6/ip6_var.h> 55 #include <netinet6/nd6.h> 56 57 static int 58 ip6_findroute(struct nhop_object **pnh, const struct sockaddr_in6 *dst, 59 struct mbuf *m) 60 { 61 struct nhop_object *nh; 62 63 nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr, 64 dst->sin6_scope_id, NHR_NONE, m->m_pkthdr.flowid); 65 if (nh == NULL) { 66 IP6STAT_INC(ip6s_noroute); 67 IP6STAT_INC(ip6s_cantforward); 68 icmp6_error(m, ICMP6_DST_UNREACH, 69 ICMP6_DST_UNREACH_NOROUTE, 0); 70 return (EHOSTUNREACH); 71 } 72 if (nh->nh_flags & NHF_BLACKHOLE) { 73 IP6STAT_INC(ip6s_cantforward); 74 m_freem(m); 75 return (EHOSTUNREACH); 76 } 77 78 if (nh->nh_flags & NHF_REJECT) { 79 IP6STAT_INC(ip6s_cantforward); 80 icmp6_error(m, ICMP6_DST_UNREACH, 81 ICMP6_DST_UNREACH_REJECT, 0); 82 return (EHOSTUNREACH); 83 } 84 85 *pnh = nh; 86 87 return (0); 88 } 89 90 struct mbuf* 91 ip6_tryforward(struct mbuf *m) 92 { 93 struct sockaddr_in6 dst; 94 struct nhop_object *nh; 95 struct m_tag *fwd_tag; 96 struct ip6_hdr *ip6; 97 struct ifnet *rcvif; 98 uint32_t plen; 99 int error; 100 101 /* 102 * Fallback conditions to ip6_input for slow path processing. 103 */ 104 ip6 = mtod(m, struct ip6_hdr *); 105 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 || 106 ip6->ip6_nxt == IPPROTO_HOPOPTS || 107 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 108 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) || 109 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) || 110 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || 111 in6_localip(&ip6->ip6_dst)) 112 return (m); 113 /* 114 * Check that the amount of data in the buffers 115 * is as at least much as the IPv6 header would have us expect. 116 * Trim mbufs if longer than we expect. 117 * Drop packet if shorter than we expect. 118 */ 119 rcvif = m->m_pkthdr.rcvif; 120 plen = ntohs(ip6->ip6_plen); 121 if (plen == 0) { 122 /* 123 * Jumbograms must have hop-by-hop header and go via 124 * slow path. 125 */ 126 IP6STAT_INC(ip6s_badoptions); 127 goto dropin; 128 } 129 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 130 IP6STAT_INC(ip6s_tooshort); 131 in6_ifstat_inc(rcvif, ifs6_in_truncated); 132 goto dropin; 133 } 134 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 135 if (m->m_len == m->m_pkthdr.len) { 136 m->m_len = sizeof(struct ip6_hdr) + plen; 137 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 138 } else 139 m_adj(m, sizeof(struct ip6_hdr) + plen - 140 m->m_pkthdr.len); 141 } 142 143 /* 144 * Hop limit. 145 */ 146 #ifdef IPSTEALTH 147 if (!V_ip6stealth) 148 #endif 149 if (ip6->ip6_hlim <= IPV6_HLIMDEC) { 150 icmp6_error(m, ICMP6_TIME_EXCEEDED, 151 ICMP6_TIME_EXCEED_TRANSIT, 0); 152 m = NULL; 153 goto dropin; 154 } 155 156 bzero(&dst, sizeof(dst)); 157 dst.sin6_family = AF_INET6; 158 dst.sin6_len = sizeof(dst); 159 dst.sin6_addr = ip6->ip6_dst; 160 161 /* 162 * Incoming packet firewall processing. 163 */ 164 if (!PFIL_HOOKED_IN(V_inet6_pfil_head)) 165 goto passin; 166 if (pfil_mbuf_in(V_inet6_pfil_head, &m, rcvif, NULL) != 167 PFIL_PASS) 168 goto dropin; 169 /* 170 * If packet filter sets the M_FASTFWD_OURS flag, this means 171 * that new destination or next hop is our local address. 172 * So, we can just go back to ip6_input. 173 * XXX: should we decrement ip6_hlim in such case? 174 * 175 * Also it can forward packet to another destination, e.g. 176 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf. 177 */ 178 if (m->m_flags & M_FASTFWD_OURS) 179 return (m); 180 181 ip6 = mtod(m, struct ip6_hdr *); 182 if ((m->m_flags & M_IP6_NEXTHOP) && 183 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) { 184 /* 185 * Now we will find route to forwarded by pfil destination. 186 */ 187 bcopy((fwd_tag + 1), &dst, sizeof(dst)); 188 m->m_flags &= ~M_IP6_NEXTHOP; 189 m_tag_delete(m, fwd_tag); 190 } else { 191 /* Update dst since pfil could change it */ 192 dst.sin6_addr = ip6->ip6_dst; 193 } 194 passin: 195 /* 196 * Find route to destination. 197 */ 198 if (ip6_findroute(&nh, &dst, m) != 0) { 199 m = NULL; 200 in6_ifstat_inc(rcvif, ifs6_in_noroute); 201 goto dropin; 202 } 203 if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) { 204 if (m->m_pkthdr.len > nh->nh_mtu) { 205 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig); 206 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu); 207 m = NULL; 208 goto dropout; 209 } 210 goto passout; 211 } 212 213 /* 214 * Outgoing packet firewall processing. 215 */ 216 if (pfil_mbuf_out(V_inet6_pfil_head, &m, nh->nh_ifp, 217 NULL) != PFIL_PASS) 218 goto dropout; 219 220 /* 221 * We used slow path processing for packets with scoped addresses. 222 * So, scope checks aren't needed here. 223 */ 224 if (m->m_pkthdr.len > nh->nh_mtu) { 225 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig); 226 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu); 227 m = NULL; 228 goto dropout; 229 } 230 231 /* 232 * If packet filter sets the M_FASTFWD_OURS flag, this means 233 * that new destination or next hop is our local address. 234 * So, we can just go back to ip6_input. 235 * 236 * Also it can forward packet to another destination, e.g. 237 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf. 238 */ 239 if (m->m_flags & M_FASTFWD_OURS) { 240 /* 241 * XXX: we did one hop and should decrement hop limit. But 242 * now we are the destination and just don't pay attention. 243 */ 244 return (m); 245 } 246 /* 247 * Again. A packet filter could change the destination address. 248 */ 249 ip6 = mtod(m, struct ip6_hdr *); 250 if (m->m_flags & M_IP6_NEXTHOP) 251 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); 252 else 253 fwd_tag = NULL; 254 255 if (fwd_tag != NULL || 256 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) { 257 if (fwd_tag != NULL) { 258 bcopy((fwd_tag + 1), &dst, sizeof(dst)); 259 m->m_flags &= ~M_IP6_NEXTHOP; 260 m_tag_delete(m, fwd_tag); 261 } else 262 dst.sin6_addr = ip6->ip6_dst; 263 /* 264 * Redo route lookup with new destination address 265 */ 266 if (ip6_findroute(&nh, &dst, m) != 0) { 267 m = NULL; 268 goto dropout; 269 } 270 } 271 passout: 272 #ifdef IPSTEALTH 273 if (!V_ip6stealth) 274 #endif 275 { 276 ip6->ip6_hlim -= IPV6_HLIMDEC; 277 } 278 279 m_clrprotoflags(m); /* Avoid confusing lower layers. */ 280 IP_PROBE(send, NULL, NULL, ip6, nh->nh_ifp, NULL, ip6); 281 282 if (nh->nh_flags & NHF_GATEWAY) 283 dst.sin6_addr = nh->gw6_sa.sin6_addr; 284 error = (*nh->nh_ifp->if_output)(nh->nh_ifp, m, 285 (struct sockaddr *)&dst, NULL); 286 if (error != 0) { 287 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard); 288 IP6STAT_INC(ip6s_cantforward); 289 } else { 290 in6_ifstat_inc(nh->nh_ifp, ifs6_out_forward); 291 IP6STAT_INC(ip6s_forward); 292 } 293 return (NULL); 294 dropin: 295 in6_ifstat_inc(rcvif, ifs6_in_discard); 296 goto drop; 297 dropout: 298 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard); 299 drop: 300 if (m != NULL) 301 m_freem(m); 302 return (NULL); 303 } 304